A suspicious message is not always badly written. It may look like an ordinary request from a supplier or colleague, timed when your team is busy. Technology matters, but the business process around payments and sensitive changes deserves just as much attention.
A convincing email should still have to pass a reliable business process before it changes money or access.
Recognise the decision the attacker wants
Phishing attempts may seek credentials, a payment, sensitive information or a change to bank details. Instead of judging only spelling or presentation, teach people to pause when a message asks for an unusual action. Urgency, secrecy or a change from the normal approval route should invite verification. A familiar display name is not enough to establish who is making a request.
Technical background: NCSC: Phishing scams ↗
Verify through a separate trusted route
Set a rule for changes to supplier bank details and other high-impact requests. Use contact information already held in an approved record, rather than a number included in the new message. Define who checks the request and who authorises the change. Make the process practical enough to use on a busy day. Staff should have permission to delay an unusual payment while checks are completed.
Make reporting quick and blame-free
Explain how to report a suspicious message and how to raise a concern after clicking or sharing information. Ask for the message and relevant context without encouraging people to forward suspicious content widely. A calm reporting culture helps the team act sooner. Focus training on decisions staff actually make, such as invoices, delivery notices and account changes, rather than on catching people out.
Connect the process to technical controls
Review email protection, authentication and the authority to change mailbox settings. Decide who investigates suspected account compromise and how the finance team is contacted. Keep payment records and incident notes accessible to authorised people. If a payment may be fraudulent, use established bank and incident-response channels promptly. The business process and the technical response should reinforce each other.
PUT IT INTO PRACTICE
Your starting checklist.
Use these prompts to prepare your next decision or conversation.
YOUR NEXT STEP WITH IT MOUNTAIN
Turn the question into a plan.
Discuss staff awareness, email protection and escalation with IT Mountain. Connect security controls to the way your business approves sensitive requests.
